CHAPTER 18 RISK MANAGEMENT by Hannes Valtonen, CFA LEARNING OUTCOMES After completing this chapter, you should be able to do the following: a Define risk and identify types of risk; b Define risk management; c Describe a risk management process; d Describe risk management functions; e Describe benefits and costs of risk management; f Define operational risk and explain how it is managed; g Define compliance risk and explain how it is managed; h Define investment risk and explain how it is managed; i Define value at risk and describe its advantages and weaknesses. Definition and Classification of Risks 147 INTRODUCTION 1 Risk is part of your daily life, and whether you realise it or not, you often act as a risk manager. Before crossing a busy road, you first assess that it is safe for you to do so; if you take a toddler to the swimming pool, you make sure that she is wearing inflatable armbands before she gets into the water and that she is never left unattended; you have probably purchased car, home, and/or health insurance to protect you and your family against accidents, disasters, or illnesses. Thus, in the course of your life, you are well acquainted with identifying risks, assessing them, and selecting the appropriate response, which is what risk management is about. This chapter puts the emphasis on the types of risks that companies in the invest- ment industry (investment firms) and people working for these companies face. It is important for companies to develop a structured process that helps them recognise and prepare for a wide range of risks. Although risk management is sometimes viewed as a specialist function, a good risk management process will encompass the entire company and filter down from senior management to all employees, giving them guidance in carrying out their roles. Any action that you take as an employee may affect your company’s risk profile, even if these actions are “only” regular daily activities. An unintentional error can cause substantial damage to a company, so it is important that you gain a good understanding of the types of risks companies in the investment industry face and that you learn how these risks are managed. Risk Management DEFINITION AND CLASSIFICATION OF RISKS 2 Risk can take different forms. Although there is no universal classification of risks, this section identifies typical risks to which companies in the investment industry are exposed. 2.1 Definition of Risk Risk arises out of uncertainty. It can be defined as the effect of uncertain future events on a company or on the outcomes the company achieves. One of these outcomes is the company’s profitability, which is why the effects of risk on profit and rates of return are often assessed. © 2014 CFA Institute. All rights reserved. 148 Chapter 18 ■ Risk Management Events that have or could have a negative effect, leading to losses or negative rates of return, tend to be emphasised in discussions of risk. Some of these events are external to the company. For example, a bank that has a large portfolio of commercial loans may suffer substantial losses if the economy goes into recession and corporate defaults increase. Other events, such as internal fraud or network failure, are inter- nal to the company. But not all outcomes from events are negative. Some events can have a positive effect on the company, creating opportunities for gains. For example, a company that takes the risk of investing in a country with tight capital controls (or controls on flows in financial markets) may benefit if the capital controls are lifted and the company becomes one of the few foreign companies licensed to buy and sell securities in that country. So, the assessment of risk needs to include opportunities as well as threats. 2.2 Classification of Risks Risks are classified according to the source of uncertainty. There is a long list of sources of uncertainty, so there is a correspondingly long list of risks. Relatively well-defined categories of risk exist, but no standard risk classification system applies to all com- panies because risks should be classified in a manner that helps managers make better decisions in the context of their particular company and its environment. All companies face the risk of not being able to operate profitably in a given com- petitive environment, typically because of a shift in market conditions. For example, a company’s ability to grow and remain profitable may be affected by changes in customer preferences, the evolution of the competitive landscape, or product and technology developments. There are three risks to which companies in the investment industry are typically exposed and that are discussed in this chapter: ■■ Operational risk, which refers to the risk of losses from inadequate or failed people, systems, and internal policies and procedures, as well as from external events that are beyond the control of the company but that affect its operations. Examples of operational risk include human errors, internal fraud, system mal- functions, technology failure, and contractual disputes. ■■ Compliance risk, which relates to the risk that a company fails to follow all applicable rules, laws, and regulations and faces sanctions as a result. ■■ Investment risk, which is the risk associated with investing that arises from the fluctuation in the value of investments. Although it is an important risk for investment professionals, it is less important for individuals involved in support activities, so it receives less coverage than operational and compliance risks in this chapter.1 1 Investment risks are discussed elsewhere in the curriculum. It was introduced in the Quantitative Concepts chapter and discussed further in the Investment Management chapter. The Risk Management Process 149 THE RISK MANAGEMENT PROCESS 3 A good risk management process helps companies reduce the likelihood and severity of adverse events and enhance management’s ability to realise opportunities. The consequences of inadequate risk management include investment losses and even bankruptcy. Other costly consequences are also possible, such as sanctions for the breach of regulations, loss of licenses to provide financial services, and damage to the company’s reputation and the reputations of its employees. A risk management process provides a framework for identifying and prioritising risks; assessing their likelihood and potential severity; taking preventive or mitigating actions, if necessary; and constantly monitoring and making adjustments. A company’s risk management process is not always consistently planned; it often evolves in response to crises, incorporating the lessons learned and the new regulatory requirements that sometimes follow these crises. Well- run companies, however, benefit from people and processes that enable forward-looking attention to emerging risks. 3.1 Definition of Risk Management Risk management is an iterative process used by organisations to support the identifi- cation and management of risk (or uncertainty) and reduce the changes and/or effects of adverse events while enhancing the realisation of opportunities and the ability to achieve company objectives. These objectives may take different forms, but they are typically driven by a company’s mission and strategy. A common corporate objective is to create value in a business environment that is usually fraught with uncertainty. So, an important objective of the risk management process is to help managers deal with this uncertainty and identify the threats and opportunities their company faces. One of the main functions of risk management is to find the right balance between risk and return. Shareholders in a company or investors in a fund have invested their money for the promise of a return at some risk level. By limiting the effect of events that may derail the company’s ability to achieve its objectives while benefiting from opportunities to grow the company profitably, risk management plays an important role in delivering value for these shareholders and investors. The involvement of the board of directors and senior management in risk management is critical because they set corporate strategy and strategic business objectives. Although directors and senior managers are in charge of setting the appropriate level of risk to support the corporate strategy, risk management should involve all employees. One employee making an inaccurate or fraudulent assessment can damage the reputation of his or her company and even lead to its demise. Reputations take years to build but they can be lost in an instant. Markets are increasingly interdependent, and media and the internet can spread the news of a mistake or scandal across the globe in a matter of minutes. Thus, risk management is critical to protecting reputations as well as maintaining confidence among market participants and trust in the financial system. 150 Chapter 18 ■ Risk Management 3.2 Steps in the Risk Management Process A structured risk management process generally includes five steps, as illustrated in Exhibit 1. Exhibit 1 Risk Management Process es De ctiv Ide te je nt ct b ify a O n t Ev d e e S n t s Risk C o Management k M n d t Process n s i o r a n o R l s it e a s o s r n e i d s it s r o A ri P S elect a Risk Response 3.2.1 Set Objectives Setting objectives is an important part of business planning. Risk management enables management to identify potential events that could affect the realisation of those objectives. A company may set strategic objectives, which are typically high-level objectives connected to its mission. It may also define objectives that are related to its operations. Many of these objectives depend on external factors that may be difficult for companies to influence and control, which leads to a high degree of uncertainty.